CVE-2026-49839

A flaw was found in jq, a command-line JSON processor. This vulnerability allows an attacker to trigger a heap out-of-bounds write by providing a specially crafted, oversized file to the jq --rawfile option. This can lead to a denial of service (DoS), making the affected system or application unavailable, and may also impact data integrity. Exploitation requires user interaction, as a user must process the malicious file.

A flaw was found in jq, a command-line JSON processor. When using the --rawfile option to process an oversized file, jq can trigger a heap out-of-bounds write in assertion-disabled builds (typical for release builds). Exploitation requires a local user to explicitly process an attacker-controlled file. With assertions enabled, the process aborts instead of corrupting memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using jq --rawfile with untrusted or user-controlled files.